Re: [PATCH 2/3] lsm: introduce security_lsm_manage_policy hook
From: Song Liu <song@kernel.org>
Date: 2025-05-07 06:19:27
Also in:
linux-security-module, lkml
On Tue, May 6, 2025 at 7:40 AM Maxime Bélair [off-list ref] wrote:
Define a new LSM hook security_lsm_manage_policy and wire it into the lsm_manage_policy() syscall so that LSMs can register a unified interface for policy management. This initial, minimal implementation only supports the LSM_POLICY_LOAD operation to limit changes. Signed-off-by: Maxime Bélair <redacted>
[...]
quoted hunk ↗ jump to hunk
diff --git a/security/security.c b/security/security.c index fb57e8fddd91..256104e338b1 100644 --- a/security/security.c +++ b/security/security.c@@ -5883,6 +5883,27 @@ int security_bdev_setintegrity(struct block_device *bdev, } EXPORT_SYMBOL(security_bdev_setintegrity); +/** + * security_lsm_manage_policy() - Manage the policies of LSMs + * @lsm_id: id of the lsm to target + * @op: Operation to perform (one of the LSM_POLICY_XXX values) + * @buf: userspace pointer to policy data + * @size: size of @buf + * @flags: lsm policy management flags + * + * Manage the policies of a LSM. This notably allows to update them even when + * the lsmfs is unavailable is restricted. Currently, only LSM_POLICY_LOAD is + * supported. + * + * Return: Returns 0 on success, error on failure. + */ +int security_lsm_manage_policy(u32 lsm_id, u32 op, void __user *buf, + size_t size, u32 flags) +{ + return call_int_hook(lsm_manage_policy, lsm_id, op, buf, size, flags);
If the LSM doesn't implement this hook, sys_lsm_manage_policy will return 0 for any inputs, right? This is gonna be so confusing for users. Thanks, Song